Disposition the 23 un-triaged bot findings from the #2320 beta.47 promote review

[jaylfc]

What this is

PR #2320 was the beta.47 promote PR, so CodeRabbit and Kilo reviewed cumulative dev code rather than one feature. That produced 23 substantive findings that were never dispositioned. They are enumerated below with file:line so nobody has to go archaeology through the PR thread.

No rush on any of this, and please treat it as a queue to pull from rather than a batch to finish. Splitting it across several small PRs is preferred over one large one.

Important: re-verify before fixing

These findings are dated and the tree has moved a long way since. Several are likely already fixed — a previous audit found #2412's criticals had been fixed on dev while the comments still read as open. So the first step per item is to check it against current dev, not to start editing.

Please give each item one of three verdicts:

• CONFIRMED-live — still reproduces on current dev. Fix it, and prove the red first: a test that fails on today's dev and passes with your change.
• ALREADY-FIXED — name the commit or the code that fixes it. No PR needed.
• NOT-APPLICABLE — say why in one line (bot misread the flow, intentional design, dead path).

A partial honest pass is worth more than a complete-looking one. If only six of these turn out to be real, "six real, here they are, the rest are these verdicts" is exactly the right answer. Please do not fill in verdicts you have not actually checked — an unchecked item left as unchecked is genuinely more useful to me than a guess, because I act on these.

Priority order

Start with the security-adjacent ones (the first five). The rest are in no particular order.

1. tinyagentos/routes/agent_auth_requests.py:89 — CRITICAL (CodeRabbit) — Bind project_notes through _PROJECT_SCOPES. project_notes is project-bound but absent from _PROJECT_SCOPES, so the required explicit project_id check never runs and a non-deferred approval can use the unauthenticated request path.
2. tinyagentos/agent_token_auth.py:119 — Major — Apply token rotation to check_agent_identity. The token_min_iat cutoff only guards _verify_agent_scope; check_agent_identity validates the same token without it, so a superseded token still passes.
3. tinyagentos/routes/agent_registry.py:785 — Major — Rotation resolution is integer-second iat. A token minted in the same Unix second as the rotation has iat == token_min_iat and the < check accepts it, so rotation does not invalidate everything issued before it.
4. desktop/src/lib/knowledge.ts:66 — Major — Restore CSRF wrapping in the JSON request helpers. The Headers rewrite passes a plain RequestInit to fetch, so mutating callers omit X-CSRF-Token.
5. tinyagentos/routes/device_pair_requests.py:179 — Major — A pairing request that cannot raise a Decision still returns 200 and consumes a cap slot (when decision_store is None or _admin_user_id() returns "" the approval block is skipped but the route still reports success).
6. scripts/check_doc_gate.py:121 — Major — _validate_config accepts when_changed = 1 because it only checks the rule is a table; the invalid value reaches rule evaluation instead of returning EXIT_CONFIG_ERROR.
7. scripts/collate_changelog.py:116 — Major — Make insertion and fragment cleanup retry-safe. If CHANGELOG.md ends right after ## [Unreleased], the anchor match fails and the script deletes every fragment without inserting.
8. .claude/skills/taos-agent/SKILL.md:89 — Major — Pin the controller installer to a release commit and verify it before running as root.
9. .claude/skills/taos-agent/SKILL.md:113 — Skill still says Tasks where the app was renamed Routines; an OS-native agent would try to open an app that does not exist.
10. tests/conftest.py:511 — Kilo CRITICAL.
11. desktop/src/components/__tests__/ToolCallBlock.test.tsx:46 — Kilo CRITICAL.
12. tinyagentos/routes/device_pair_requests.py:46 — Kilo WARNING.
13. tinyagentos/routes/device_pair_requests.py:175 — Kilo WARNING.
14. tinyagentos/device_pair_requests_store.py:243 — Kilo WARNING.
15. tinyagentos/routes/notifications.py:54 — Kilo WARNING.
16. desktop/src/apps/LibraryApp.tsx:149 — Kilo WARNING.
17. desktop/src/apps/LibraryApp.tsx:1230 — Kilo WARNING.
18. desktop/src/apps/LibraryApp.tsx:1257 — Kilo WARNING.
19. desktop/src/components/ToolCallBlock.tsx:62 — Kilo WARNING.
20. desktop/src/apps/chat/__tests__/render-helpers.test.tsx:107 — Kilo WARNING.
21. desktop/src/apps/chat/ChannelSidebar.tsx:274 — Kilo SUGGESTION.
22. desktop/src/apps/chat/ChannelSidebar.tsx:501 — Kilo SUGGESTION.
23. desktop/src/lib/projects.ts:163 — Kilo SUGGESTION — headers.set("Content-Type", ...) unconditionally overwrites caller-provided headers; the previous code spread ...(init?.headers || {}) so callers could override.

Items 10-22 are Kilo inline comments whose full text is on PR #2320 at those exact paths and lines — I have deliberately not paraphrased the ones I have not read closely myself, so you get the bot's words rather than my summary of them.

Heads-up on file overlap

Your #2048 is in my review queue and touches the agent auth / delegation area, which is adjacent to item 1 (routes/agent_auth_requests.py). Worth landing #2048 first, or having whoever takes item 1 rebase after it, so your own workers do not collide.

Acceptance

• Each of the 23 has a verdict (CONFIRMED-live / ALREADY-FIXED / NOT-APPLICABLE with a one-line reason).
• Every CONFIRMED-live fix ships with a test that fails before and passes after.
• Changelog fragment per PR under changelog.d/ as usual for non-test changes.
• Small PRs, batched however is convenient for your queue.

Context on why this is coming to you rather than our own lanes: we tried this as a single "disposition all findings" task three times internally and it failed three different ways (scratch files in the repo root, then fabricated evidence rows, then an honest but very small subset). Per-finding work has a much better track record here, which is why the contract above is per-finding with explicit verdicts. Jay's call was to route batches like this to your team. Credit stays with your agents on whatever lands, and I will review at code level promptly as usual.